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DETAILED ACTION 

r. 

r ^ 

Claim Rejections - 35 U.S.C. § 101 

1 . 35 U.S.C. §1 01 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

the Invention as disclosed in claims 1-80 is directed to non-statutory subject matter. 

"1 

2. Regardless of whether any of the claims are in the technological arts, none of 
them is limited to practical applications in the technological arts. Examiner finds that In 
re Warmerdam, 33 F.3d 1354, 31 USPQ2d 1754 (Fed. Cir. 1994) controls the 35 U.S.C. 
§101 issues on that point for reasons made clear by the Federal Circuit in AT&T Corp. 
V. Excel Communications, Inc., 50 USPQ2d 1447 (Fed. Cir. 1999). Specifically, the 
Federal Circuit held that the act of: 

...piaking several abstract ideas and manipulating them together adds 
nothing to the basic equation. AT&T v. Excel at 1453 quoting In re 
Warmerdam, 33 F.3d 1354, 1360 (Fed. Cir. 1994). 

Examiner finds that Applicant's "information identifying ... users that are members of the 
group" and "information identifying ... items that are members of the group" references 
are just such abstract ideas. 
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3. Examiner bases his position upon guidance provided by the Federal Circuit in In 
re Warmerdam, as interpreted by AT&T v. Excel, This set of precedents is within the 
same line of cases as the Alappat-State Street Bank decisions and is in complete 
agreement with those decisions. Warmerdam is consistent with State Streets holding 
that: 

Today we hold that the transformation of data, representing discrete dollar 
amounts, by a machine through a series of mathematical calculations into a 
final share price, constitutes a practical application of a mathematical 
algorithm, formula, or calculation because it produces 'a useful, concrete and 
tangible result" - a final share price momentarily fixed for recording purposes 
and even accepted and relied upon by regulatory authorities and in 
subsequent trades, (emphasis added) State Street Bank at 1601 . 

4. True enough, that case later eliminated the "business method exception" in order 
to show that business methods were not per se nonstatutory, but the court clearly did 
not go so far as to make business methods per se statutory. A plain reading of the 
excerpt above shows that the Court was very specific in its definition of the new 
practical application. It would have been much easier for the court to say that "business 
methods were per se statutory" than it was to define the practical application in the case 
as "...the transformation of data, representing discrete dollar amounts, by a machine 
through a series of mathematical calculations into a final share price..." 

5. The court was being very specific. 

6. Additionally, the court was also careful to specify that the "useful, concrete and 
tangible result" it found was "a final share price momentarily fixed for recording 
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purposes and even accepted and relied upon by regulatory authorities and in 
subsequent trades ." (i.e. the trading activity is the further practical use of the real world 
monetary data beyond the transformation in the computer - i.e., "post-processing 
activity".) 

7. Applicant cites no such specific results to define a useful, concrete and tangible 
result. Neither does Applicant specify the associated practical application with the kind 
of specificity the Federal Circuit used. 

8. Furthermore, in the case In re Warmerdam, the Federal Circuit held that: 



... mhe dispositive issue for assessing compliance with Section 101 in this 
case Is whether the claim is for a process that goes beyond simply 
manipulating 'abstract ideas* or 'natural phenomena' ... As the Supreme 
Court has made clear, *[a]n idea of itself is not patentable, ... faking several 
abstract ideas and manipulating them together adds nothing to the basic 
equation . In re Warmerdam 31 USPQ2d at 1759 (emphasis added). 
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9. Since the Federal Circuit held in Warmerdam that this is the "dispositive issue" 
when it judged the usefulness, concreteness, and tangibility of the claim limitations in 
that case, Examiner in the present case views this holding as the dispositive issue for 
determining whether a claim is "useful, conaete, and tangible" in similar cases. 
Accordingly, the Examiner finds that Applicant manipulated a set of abstract 
"information identifying ... users that are members of the group" and "information 
identifying ... items that are members of the group" to solve purely algorithmic problems 
in the abstract. 

1 0. Since the claims are not limited to exclude such abstractions, the broadest 
reasonable interpretation of the claim limitations includes such abstractions. Therefore, 
the claims are impermissibly abstract under 35 U.S.C. §101 doctrine. 

1 1 . Since Warmerdam is within the Alappat-State Street Bank line of cases, it takes 
the same view of "useful, concrete, and tangible" the Federal Circuit applied in State 
Street Bank, Therefore, under State Street Bank, this could not be a "useful, conaete 
and tangible result". There is only manipulation of abstract ideas. 

12. The Federal Circuit validated the use of Warmerdam in its more recent AT&T 
Corp, V, Excel Communications, Inc. decision. The Court reminded us that: 

Finally, the decision in In re Wamierdam, 33 F.3d 1354, 31 
USPQ2d 1 754 (Fed. Cir. 1 994) is not to the contrary. *** The court found 
that the claimed process did nothing more than manipulate basic 
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mathematical constructs and concluded that 'taking s veral abstract ideas 
and manipulating them together adds nothing to the basic equation' : 
hence, the court held that the claims were properly rejected under §1 01 ... 
Whether one agrees with the court's conclusion on the facts, the holding of 
the case is a straightforward application of the basic principle that mere laws 
of nature, natural phenomena, and abstract ideas are not within the 
categories of inventions or discoveries that may be patented under §101 . 
(emphasis added) AT&T Corp. v. Excel Communications, Inc., 50 
USPQ2d 1447, 1453 (Fed. Cir. 1999). 

1 3. Remember that in In re Warmerdam, the Court said that this was the dispositive 
issue to be considered. In the >Ar&7decision cited above, the Court reaffirms that this is 
the issue for assessing the "useful, concrete, and tangible" nature of a set of claims 
under 101 doctrine. Accordingly, Examiner views the Warmerdam holding as the 
dispositive issue in this analogous case. 

14. The fact that the invention is merely the manipulation of abstract ideas is clear. 
The data referred to by Applicant's phrases "information identifying ... users that are 
members of the group" and "information identifying ... items that are members of the 
group" are simply abstract constructs that do not limit the claims to the transformation of 
real world data (such as monetary data or heart rhythm data) by some disclosed 
process. Consequently, the necessary conclusion underyAT&T, State Street and 
Warmerdam, is straightforward and clear. The claims take several abstract ideas (i.e., 
"information identifying ... users that are members of the group" and "information 
identifying ... items that are members of the group" in the abstract) and manipulate 
them together adding nothing to the basic equation. Claims 1-80 are, thereby, rejected 
under 35 U.S.C. 101. 
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15. Regarding the "system" recitals in claims 59-65, and 77-80 and the presumed 
"product of manufacture" claims in claims 67-76, the invention is still found to be 
nonstatutory. Any other finding would be at variance with current case law. Specifically, 
the Federal Circuit held in AT&T v. Excel, 50 USPQ2d 1447 (Fed. Cir. 1999) that: 

Whether stated implicitly or explicitly, we consider the scope of 
Section 101 to be the same reqaixtless of the form - machine or process 
- in which a particular claim is drafted . AT&T v. Excel, 50 USPQ2d 1447, 
1452 citing In re Alappat, 33 F.3d at 1581 . 31 USPQ2d at 1589 (Rader, J., 
concun-ing) (emphasis added.) 

16. Examiner considers the scope of Section 101 to be the same regardless of 
whether Applicant claims a "process", "machine", or "product of manufacture". While 
the "system" recitals in the preambles of claims 59-65, and 77-80 make the claims 
ostensibly drawn to be "apparatus" claims, they are insufficient by themselves to limit 
the claims to statutory subject matter. Likewise, the presumed attempts to limit claims 
67-76 to "product of manufacture" claims are insufficient by themselves to limit the 
claims to statutory subject matter. Examiner's position is clearly consistent with Alappat, 
and AT&T and is implicitly consistent with Warmerdam and State Street Accordingly, 
those claims are also properly rejected. 

Claim Rejections - 35 U.S.C. § 112 

The following is a quotation of the first paragraph of 35 U.S.C. §112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the 
art to which it pertains, or with which it is most nearly connected, to make and use the same and shall 
set forth the best mode contemplated by the inventor of canning out his invention. 
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Claims 1-80 are rejected under 35 U.S.C. §1 12, first paragraph because current 
case law (and accordingly, the MPEP) require such a rejection if a §101 rejection is 
given because when Applicant has not in fact disclosed the practical application for the 
invention, as a matter of law there is no way Applicant could have disclosed how to 
practice the undisclosed practical application. This is how the MPEP puts it: 



("The how to use prong of section 1 1 2 incorporates as a matter of law the 
requirement of 35 U.S.C. 101 that the specification disclose as a matter of 
fact a practical utility for the invention.... If the application fails as a matter of 
fact to satisfy 35 U.S.C. S 101 . then the application also fails as a matter 
of law to enable one of ordinary skill in the art to use the invention under 35 
U.S.C. S112.") : In re Kirk, 376 F.2d 936, 942, 153 USPQ 48, 53 (CCPA 
1967) ("Necessarily, compliance with § 1 12 requires a description of how to 
use presently useful inventions, otherwise an applicant would 
anomalously be required to teach how to use a useless 
invention.").See, MPEP 21 07.01 (IV), quoting In re Kirk (emphasis added). 



Therefore, claims 1-80 are rejected on this basis. 



Claim Rejections - 35 U.S.C. § 102 

17. The following is a quotation of the appropriate paragraphs of 35 U.S.C. §1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described In a printed publication in this or a foreign country or In public 
use or on sale In this country, more than one year prior to the date of application for patent in the United 
states. 

18. Claims 1-2, 7-16, 26-34, 41-42, 44-75, and 77-80 are rejected under 35 
U.S.C. §1 02(b) as being anticipated by Brown et al. (U.S. Patent Number 5,557,686; 
dated 09/17/1996; class 382; subclass 115). Specifically: 
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Claim 1 

Claim Vs "retrieving information identifying , for each of a plurality of groups, 
users that are members of the group;" is anticipated by Brown et al, col. 2, lin. 3-7, 
where it recites: 



Accordingly, one object of this invention is to provide a method and 
apparatus for verifying the authenticity of a user of a system having a low 
imposter pass rate, a low false alarm rate, while only requiring a small 
number of keystrokes from the user. 

Claim 1's " for each group, analyzing properties of the members of the group to 
identify properties that distinguish users that are members of the group from users that 
are not members of the group, the analyzed properties relating to interactions with the 
subject Web site undertaken by users;" is anticipated by Brown et al, col. 2, lin. 22-25, 
where it recites: 



The self-organizing network outputs purified samples of the authorized user 
which are similar in nature to each other while discarding samples of the 
user which are not similar. 

Claim Vs "to displaying the properties identified as distinguishing members of 
the selected group from users that are not members of the selected group;" is 
anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
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method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination. 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 1's "receiving user input specifying a name for the selected group: and" is 



anticipated by Brown et al, claim 3, where it recites: 



3. A method for verifying whether a user of a system is authorized using 
keystroke information according to claim 2, wherein the purifying step uses a 
self-organizing neural network to group said imposter training signals and 
said user training signals into clusters having similar keystroke 
characteristics. 



Claim 1's " persistently storing the specified name in a manner that associates 
the specified name with the selected group, enabling the specified name to be displayed 
in conjunction with the selected group at a future time." is anticipated by Brown et al, 
col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 100 has clock 104 connected to processor 102 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 1 06 for connecting the terminal to the 
host, a RAM 108, a ROM 1 10, a system bus 1 12, a keyboard interface 114 
and an optional monitor interface 116 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of tiie user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 1 12 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the program used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 
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Claim 2 

Claim 2's "The method of claim 1 , further comprising, for each selected 1 group, 
displaying with each property identified for the selected group an icon representing the 
property." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 7 

Claim 7's "A method in a computing system for analyzing each of a plurality of 
groups of items, comprising: 

retrieving information identifying, for each of a plurality of groups, items that are 
members of the group; and" is anticipated by Brown et al, col. 2, lin. 3-7, where it 
recites: 



Accordingly, one object of this invention is to provide a method and 
apparatus for verifying the authenticity of a user of a system having a low 
imposter pass rate, a low false alarm rate, while only requiring a small 
number of keystrokes from the user. 
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Claim 7's "for each group, analyzing attributes of the items of the group to identify 
attributes that distinguish items that are members of the group from items that are not 
members of the group." is anticipated by Brown et al, col. 2, lin. 22-25, where it recites: 



The self-organizing network outputs purified samples of the authorized user 
which are similar in nature to each other while discarding samples of the 
user which are not similar. 



Claim 8 

Claim 8's "The method of claim 7, further comprising, for each group, generating 
a characterization of the group that incorporates the attributes identified for the group." 
is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 9 

Claim 9's "The method of claim 7, further comprising, for at least one selected 
group, displaying indications of the identified attributes in conjunction 2 with an 
indication of the identified group." is anticipated by Brown et al, col. 13, lin. 48-59, where 
it recites: 
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Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 10 

Claim 10's "The method of claim 7, further comprising, for each selected group, 
displaying with each attribute identified for the selected group an icon representing the 
attribute." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 11 

Claim 1 rs "receiving user input specifying a name for the distinguished group; 
and" is anticipated by Brown et al, claim 3, where it recites: 



3. A method for verifying whether a user of a system is authorized using 
keystroke information according to claim 2, wherein the purifying step uses a 
self-organizing neural network to group said imposter training signals and 
said user training signals into clusters having similar keystroke 
characteristics. 
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Claim 1 1's "persistently storing the specified name in a manner that associates 
the specified name with the distinguished group, enabling the specified name to be 
displayed in conjunction with the distinguished group at a future time." is anticipated by 
Brown et al, col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 100 has clock 104 connected to processor 102 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 1 06 for connecting the terminal to the 
host, a RAM 108, a ROM 110, a system bus 112, a keyboard interface 114 
and an optional monitor interface 116 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the proqranfi used to 
determine whether the user is authorized or an imposter The present 
invention has been successfully tested using a data capture program utilizing 
tfie X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



Claim 12 

Claim 12's "The method of claim 7 wherein the analyzed attributes of the items 
are binary attributes having one of two possible values." is anticipated by Brown et al, 
col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 100 has clock 104 connected to processor 102 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 106 for connecting the terminal to the 
host, a RAM 108, a ROM 110, a system bus 1 12, a keyboard interface 114 
and an optional monitor interface 1 16 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the program used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 



1 
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the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 

Claim 13 

ClaiiTi 13's "The method of claim 12, further comprising converting values of a 
multivalued attribute having one of more than two possible values to binary values of an 
analyzed binary attribute." is anticipated by Brown et al, col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 1 00 has clock 1 04 connected to processor 1 02 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 1 06 for connecting the terminal to the 
host, a RAM 108, a ROM 110, a system bus 112, a keyboard interface 114 
and an optional monitor interface 116 connected to optional monitor 1 1 8, for 
example. Processor 102 and clock 104 are used to consti-uctthe vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the proqrann used to 
determine whether the user Is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



Claim 14 

Claim 14's "The method of claim 12, further comprising converting values of a 
continuous attribute having any of a range of numerical values to binary values of an 
analyzed binary attribute." is anticipated by Brown et al, col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 1 00 has clock 1 04 connected to processor 1 02 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 1 06 for connecting the terminal to the 
host, a RAM 108, a ROM 1 10, a system bus 1 12, a keyboard interface 114 
and an optional monitor interface 116 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
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host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the program used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



Claim 15 

Claim 15's "The method of claim 7 wherein the analyzed attributes of the items 
are multivalued attributes having one of more than two possible values." is anticipated 
by Brown et al, col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 100 has clock 104 connected to processor 102 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 1 06 for connecting the terminal to the 
host, a RAM 108, a ROM 110, a system bus 1 12, a keyboard interface 114 
and an optional monitor interface 116 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the program used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



Claim 16 

Claim 16's "The method of claim 7 wherein the analyzed attributes of the items 
are continuous attributes having any of a range of numerical values." is anticipated by 
Brown et al, coL 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 1 00 has clock 1 04 connected to processor 1 02 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 106 for connecting the terminal to the 
host, a RAM 108, a ROM 1 10, a system bus 1 12, a keyboard interface 114 
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and an optional monitor interface 1 1 6 connected to optional monitor 1 1 8, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the program used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



Claim 26 

Claim 26's "A computer-readable medium whose contents cause a computing 
system to analyze each of a plurality of groups of items by: 

retrieving information identifying, for each of a plurality of groups, items that are 
members of the group; and" is anticipated by Brown et al, col. 2, lin. 3-7, where it 
recites: 



Accordingly, one object of this invention is to provide a method and 
apparatus for verifying the authenticity of a user of a system having a low 
imposter pass rate, a low false alarm rate, while only requiring a small 
number of keystrokes from the user. 



Claim 26's "for each group, analyzing attributes of the items of the group to 
identify attributes that distinguish items that are members of the group from items that 
are not members of the group." is anticipated by Brown et al, col. 2, lin. 22-25, where it 
recites: 



The self-organizing network outputs purified samples of the authorized user 
which are similar in nature to each other while discarding samples of the 
user which are not similar. 



Claim 27 
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Claim 27's "The computer-readable medium of claim 26 wherein the contents of 
the computer-readable medium further cause the computing system to, for each group, 
generate a characterization of the group that incorporates the attributes identified for the 
group." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 28 

Claim 28's "The computer-readable medium of claim 26 wherein the contents of 
the computer-readable medium further cause the computing system to, for at least one 
selected group, display indications of the identified attributes in conjunction with an 
indication of the identified group." is anticipated by Brown et al, col. 13, lin. 48-59, where 
it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perfomi other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 
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Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 29 

Claim 29's "displaying information identifying the selected group; and" is 
anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 

Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 

Claim 29's "in conjunction with the displayed information identifying the selected 
group, displaying one or more icons, each icon indicating a characteristic of members of 
the selected group that differentiates typical members of the selected group from typical 
members of the other groups." is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
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method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 30 

Claim 30's "The method of claim 29 wherein a plurality of icons are displayed, 
and wherein the plurality of icons is displayed in an order corresponding to the extent to 
which the characteristic indicated by each differentiates typical members of the selected 
group from typical members of the other groups." is anticipated by Brown et al, col. 13, 
lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 31 

Claim Si's "The method of claim 29, further comprising displaying, in conjunction 
with each displayed icon, an indication of the extent to which the characteristic indicated 
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by each differentiates typical members of the selected group from typical members of 
the other groups." is anticipated by Brown et al, col. 13, lin. 48-59, NA^ere it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination. 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 32 

Claim 32's "The method of claim 29, further comprising displaying, in conjunction 
with each displayed icon, a shape whose length indicates the extent to which the 
characteristic indicated by the displayed icon differentiates typical members of the 
selected group from typical members of the other groups." is anticipated by Brown et al, 
col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal Is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any tvpe of response to the authorized user/imposter determination . 
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Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 33 

Claim 33's "The method of claim 29, further comprising displaying, in conjunction 
with each displayed icon, an indication of the extent to which the members of the 
selected group has the characteristic indicated by the icon." is anticipated by Brown et 
al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perfomi other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to qlvlnq a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 34 

Claim 34's "The method of claim 29, further comprising displaying, in conjunction 
with each displayed icon, the percentage of the members of the selected group has the 
characteristic indicated by the icon." is anticipated by Brown et al, col. 13, lin. 48-59, 
where it recites: 
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Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv tvpe of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 41 

Claim 41 's "The method of claim 29 wherein the characteristic indicated by a 
distinguished one of the displayed icons is possession of a distinguished attribute by at 
least a portion of the members of the selected group." is anticipated by Brown et al, col. 
13, lin. 48-59, where it recites: 



Altematlvely, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 42 
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Claim 42's The method of claim 29 wherein the characteristic indicated by a 
distinguished one of the displayed icons is non-possession of a distinguished attribute 
by at least a portion of the members of the selected group." is anticipated by Brown et 
al, col. 13, lin. 48-59, where it recites: 



Attematively, instead of denying the user access to the system, rt is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. Hovyever, the invention is not limited to aivinq a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 44 

Claim 44's "The method of claim 29 wherein one of the displayed icons conveys 
the likeness of a shopping basket." is anticipated by Brown et al, col. 13, lin. 48-59, 
where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv type of response to the authorized user/imposter determination . 
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Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 45 

Claim 45's "The method of claim 29 wherein the displayed icons are brand logo 
icons that indicate actions related to one or more brands of products." is anticipated by 
Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 

Claim 46 

Claim 46's "The method of claim 29 wherein one of the displayed icons conveys 
the likeness of a shopping basket overlaid by a circle-slash symbol indicating negation." 
is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
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method. However, the invention is not limrted to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 47 

Claim 47's "The method of claim 29 wherein one of the displayed icons indicates 
a high number of item purchases." is anticipated by Brown et al, col. 13, lin. 48-59, 
where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 48 

Claim 48's "The method of claim 29 wherein one of the displayed icons indicates 
a low number of item purchases." is anticipated by Brown et al, col. 13, lin. 48-59, where 
it recites: 
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Alternatively, instead of denying the user access to the system, it is possible 
to perfomi other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. Hovyever. the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 49 

Claim 49's "The method of claim 29 wherein one of the displayed icons conveys 
the likeness of a coupon." is anticipated by Brown et al, col. 13, lin, 48-59, where it 
recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 50 
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Claim 50's "The method of claim 29 wherein one of the displayed icons conveys 
the likeness of a coupon overlaid by a circle-slash symbol indicating negation." is 
anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Attematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some otiier type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 51 

Claim 51 's "The method of claim 29 wherein one of the displayed icons indicates 
a high level of coupon use." is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 
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Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 52 

Claim 52's "The method of claim 29 wherein one of the displayed icons indicates 
a low level of coupon use." is anticipated by Brown et al, col. 13. lin. 48-59, where it 
recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 53 

Claim 53's "The method of claim 29 wherein one of the displayed icons conveys 
the likeness of a dollar sign." is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
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not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 

Claim 54 

Claim 54's "The method of claim 29 wherein one of the displayed icons conveys 
the likeness of a dollar sign overlaid by a circle-slash symbol indicating negation." is 
anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perfomri other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention Is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 55 

Claim 55's "The method of claim 29 wherein one of the displayed icons indicates 
a high level of spending." is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 
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AKematively, instead of denying the user access to the system, it is possible 
to perfomi other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv type of response to the authorized user/imposter determination. 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 56 

Claim 56's "The method of claim 29 wherein one of the displayed icons indicates 
a low level of spending." is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an Imposter but is applicable 
to anv type of response to the authorized user/imposter determination. 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 57 
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Claim 57's "The method of claim 29, further comprising displaying a control 
usable by a user to specify a name for the selected group." is anticipated by Brown et 
al, col. 13, lin. 48-59, where it recites: 



Attemativety, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 

Claim 58 

Claim 58's "The method of claim 29 wherein the selected group and the other 
groups are mutually exclusive, in that no item belongs to more than one group. 

Claim 59 

Claim 59's "A computing system for characterizing a selected group of items 
relative to one or more other groups of items, comprising: 

a display device; and" is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 
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Alternativety, instead of denying the user access to the system, it is possible 
to perfonn other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Attematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



a display generation subsystem that causes to be displayed together on the 
display device:" is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
metiiod. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 
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Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



information identifying the selected group, and one or more icons, each icon 
indicating a characteristic of members of the selected group that differentiates typical 
members of the selected group from typical members of the other groups. 



Claim 60 

Claim 60's "The computing system of claim 59 wherein the display generation 
subsystem causes a plurality of icons to be displayed, in an order corresponding to the 
extent to which the characteristic indicated by each differentiates typical members of the 
selected group from typical members of the other groups." is anticipated by Brown et al, 
col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination. 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 61 
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Claim 61 's "The computing system of claim 59 wherein the display generation 
subsystem causes to be displayed, in conjunction with each displayed icon, an 
indication of the extent to which the characteristic indicated by each differentiates typical 
members of the selected group from typical members of the other groups." is 
anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination. 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 62 

Claim 62's "The computing system of claim 59 wherein the display generation 
subsystem causes to be displayed, in conjunction with each displayed icon, a shape 
whose length indicates the extent to which the characteristic indicated by the displayed 
icon differentiates typical members of the selected group from typical members of the 
other groups." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
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not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an Imposter but is applicable 
to anv type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 63 

Claim 63's "The computing system of claim 59 wherein the display generation 
subsystem causes to be displayed, in conjunction with each displayed icon, the 
percentage of the members of the selected group has the characteristic indicated by the 
icon." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 64 

Claim 64's "One or more computer memories collectively containing a data 
structure identifying possible characterizations of groups of items, comprising a plurality 
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of indications each indicating one of a plurality of possible characterizations of groups of 
items, such that the contents of the data structure may be used to select possible 
characterization that characterize a group of items." is anticipated by Brown et al, col. 
13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific rest)onse 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 65 

Claim 65's "The computer memories of claim 64 wherein the data structure 
further comprises, for each indicated possible characterization, information identifying 
an icon associated with the possible characterization, such that the contents of the data 
structure may be used to display icons associated with the selected possible 
characterizations." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal Is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 66 
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Claim 66's "The computer memories of claim 64 NA^erein the data structure 
further comprises, for each indicated possible characterization, information indicating a 
differentiation threshold, the differentiation threshold indicating the extent to which the 
subject of the possible characterization must differentiate a group of items from items in 
other groups in order for the possible characterization to apply to the group of items, 
such that possible characterizations may be selected based upon satisfaction of their 
differentiation thresholds." is anticipated by Brown et al, col. 13, lin. 48-59, where it 
recites: 

Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to anv tvpe of response to the authorized user/imposter determination . 

Claim 67 

Claim 67's "One or more generated data signals collectively conveying a data 
structure indicating a characterization of a group of items, comprising information 
identifying one or more characteristics that distinguish typical items in the group of items 
from typical items outside the group of items, such that the contents of the data 
structure may be used to display characteristics of the group of items that characterize 
the group of items." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 
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Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 68 

Claim 68's "The generated data signals of claim 67 wherein the data structure is 
displayable document." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 69 

Claim 69's "The generated data signals of claim 67 wherein the data structure is 
an HTML document." is anticipated by Brown et al, col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 100 has clock 104 connected to processor 102 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 1 06 for connecting the terminal to the 
host, a RAM 108, a ROM 1 10, a system bus 112, a keyboard interface 1 14 
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and an optional monitor interface 116 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the program used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X window system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



The prior art disclosure does not limit itself to a specific data structure type. 

Claim 70 

Claim 70's "The generated data signals of claim 67 wherein the data structure is 
an ActiveX control." is anticipated by Brown et al, col. 6, lin. 5-22, where it recites: 



To construct a vector representing the timing of keystroke characteristics, the 
terminal 1 00 has clock 1 04 connected to processor 1 02 so that the timing of 
the keystrokes can be determined. The terminal 100 also contains 
components such as host interface 106 for connecting the terminal to the 
host, a RAM 108, a ROM 1 10, a system bus 112, a keyboard interface 114 
and an optional monitor interface 116 connected to optional monitor 118, for 
example. Processor 102 and clock 104 are used to construct the vector 
representing the keystroke characteristics of the user. The vector 
representing the keystroke characteristics can be sent to host 1 12 so that 
host 112 can determine whether the user is an authorized user or an 
imposter. Alternatively, terminal 100 might contain the proqrann used to 
determine whether the user is authorized or an imposter . The present 
invention has been successfully tested using a data capture program utilizing 
the X windovy/ system running on an IBM.RTM. R/S 6000 graphics 
workstation. 



The prior art disclosure does not limit itself to a specific data structure type. 



Claim 71 
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Claim 71 's "The generated data signals of claim 67 wherein the data structure 
contains an application that displays characteristics of the group of items in a display 
area." is anticipated by Brovm et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any tvpe of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 72 

Claim 72's "The generated data signals of claim 67 wherein the data structure 
further comprises, for each identified characteristic, information identifying an icon 
representing the characteristic, such that the contents of the data structure may be used 
to display an icon representing each identified characteristic." is anticipated by Brown et 
al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any tvpe of response to the authorized user/imposter determination . 
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Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 73 

Claim 73's "The generated data signals of claim 67 wherein the data structure 
further comprises information identifying an order for the identified characteristics that 
reflects the relative extents to which the identified characteristics distinguish typical 
items in the group of items from typical items outside the group of items, such that the 
contents of the data structure may be used to display indications of the identified 
characteristics in the identified order." is anticipated by Brown et al, col. 13, lin. 48-59, 
where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perfomi other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 74 
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Claim 74's "The generated data signals of claim 73 wherein the identified order 
for the identified characteristics reflects the relative extents to which the identified 
characteristics distinguish typical items in the group of items from typical items outside 
the group of items." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perfoHTi other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke, test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Levels of access are depicted by a listing of user/imposter determinations. 



Claim 75 

Claim 75's "The generated data signals of claim 67 wherein the data structure 
further comprises information indicating the extent to which the items in the group of 
items possess each of the identified characteristics." is anticipated by Brown et al, claim 
6, where it recites: 



6. A method for verifying whether a user of a system is authorized using 
keystroke information according to claim 1 , wherein the determining step 
uses a distance method to determine a distance between a vector 
representative of the signal to be tested and a vector representative of at 
least one user training signal and if said determined distance is less than a 
predetermined distance, allowing access to the system. 
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Claim 77 

Claim 77's "One or computer memories collectively containing a data structure 
indicating a characterization of a group of items, comprising information identifying one 
or more characteristics that distinguish typical items in the group of items from typical 
items outside the group of items, such that the contents of the data structure may be 
used to display characteristics of the group of items that characterize the group of 
items." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Attemativety, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an Imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Claim 78 

Claim 78's "The computer memories of claim 77 wherein the data structure 
further comprises, for each identified characteristic, information identifying an icon 
representing the characteristic, such that the contents of the data structure may be used 
to display an icon representing each identified characteristic." is anticipated by Brown et 
al, col. 13, lin. 48-59, where it recites: 



Altematively, instead of denying the user access to the system, it is possible 
to perfonn other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
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method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 79 

Claim 79's "The computer memories of claim 77 wherein the data structure 
further comprises information identifying an order for the identified characteristics that 
reflects the relative extents to which the identified characteristics distinguish typical 
items in the group of items from typical items outside the group of items, such that the 
contents of the data structure may be used to display indications of the identified 
characteristics in the identified order." is anticipated by Brown et al, col. 13, lin. 48-59, 
where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to givina a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any type of response to the authorized user/imposter determination . 



Displaying the stored data is well within the broadest reasonable interpretation of this 
disclosure. 



Claim 80 
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Claim 80's "The computer memories of claim 79 wherein the identified order for 
the identified characteristics reflects the relative extents to which the identified 
characteristics distinguish typical items in the group of items from typical items outside 
the group of items." is anticipated by Brown et al, col. 13, lin. 48-59, where it recites: 



Alternatively, instead of denying the user access to the system, it is possible 
to perform other steps. For example, if the user is determined to be an 
imposter, the user might be required to enter additional password type 
information. Alternatively, a system operator can be notified that a user has 
not passed the keystroke test and the system operator might verify that the 
person at the terminal is actually the authorized user by some other type of 
method. However, the invention is not limited to giving a specific response 
once the user is determined to be authorized or an imposter but is applicable 
to any tvpe of response to the authorized user/imposter determination . 

Levels of access are depicted by a listing of user/imposter determinations. 



Conclusion 

19. The prior art made of record and not relied upon is considered pertinent to 
applicants disclosure. 



A. Bakisetal. (U.S. Patent Number 6,219,639 B1; dated 04/17/2001; class 704; 
subclass 246) discloses a method and apparatus for recognizing identity of 
individuals employing synchronized biometrics. 



B. Shear et al. (U.S. Patent Number 6,1 12,181 ; dated 08/29/2000; class 705; 
subclass 001) discloses systems and methods for matching, selecting. 
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narrowcasting, and/or classifying based on rights management and/or other 
information. 



Any inquiry concerning this communication or earlier communications from the . 
Examiner should be directed to Wilbert L. Starks, Jr. whose telephone number is (703) 
305-0027. 

Alternatively, inquiries may be directed to the following: 

S. P. E. Anil Khatri (703) 305-0282 

After-final (FAX) (703) 746-7238 

Offlcial (FAX) (703) 746-7239 

Non-Official/Draft (FAX) (703) 746-7240 




